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Braking System For Vehicles, In Particular 
Utility Vehicles, Comprising At Least 
Two Separate Electronic Braking Control Circuits 

5 RELATED APPLIC ATION INFORMATION 

The present application claims the benefit of and was filed 
as PCT/EP2004/00 4810 on May 6, 2004 which claims priority to 
German patent application no. 103 20 608.6, which was filed 
in the German patent office on May 8 , 2003 . Both applications 
10 (including the English translation of PCT/EP2004/00481C) 
filed herewith) are all hereby incorporated by reference in 
their entirety. 

FIELD OF THE INVENTION 

Dcocript ion 

15 The present invention relates to a braking system for vehicles 
in accordance with the precharactcriging clause of patent 
claim 1.^ 

BACKGROUND INFORMATION 

DE 199 04 721 Al dig close p refers to an electromechanically 
20 actuated vehicle braking system which has electrical braking 
control circuits, namely one for the brakes on the front axle 
and one for the brakes on the rear axle. The two control 
circuits each have their own power supply and their own 
electronic control unit, which are electrically connected to 
25 a brake pedal. The two control units operate independently 
of one another but can communicate with one another and can 
thereby detect faults in a control unit . A fault is then deemed 
to be present when the two control units determine different 
control signals from the same sensor input signals. In the 
30 event of a fault, the two control units are deactivated and 
the brakes are then controlled by decentralized control units 
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which are assigned to the individual wheels and can perform 
only simple basic functions. 

Modern utility vehicle braking systems have a dual -circuit 
pneumatic control system and an electronic braking control 
system, thus making it possible to transmit signals in a more 
rapid manner and improving the response behavior of the 
braking system. The costs of electromechanical control 
components are also frequently lower than the costs of 
pneumatic control components. Another advantage is the lower 
outlay on installation. Electropneumat ic braking systems, in 
particular, in which the braking force is applied using 
compressed air but braking is controlled electronically are 
customary nowadays. A fundamental "quality criterion" of 
electrical or electronic braking control systems is their 
reliability or fail-safety. 

DE 199 15 253 Al refers to a braking system for vehicles, said 
braking system having two brake circuits and containing, in 
a central unit, two microcomputers which are each supplied 
with power from separate power sources. The two 
2 0 microcomputers activate a plurality of brake actuating 
devices for individual wheel brakes using two separate 
redundant bus systems. This activation is always effected in 
a parallel manner using the two bus systems. Measuring devices 
which are coupled to a brake pedal are provided in order to 
2 5 activate the two microcomputers. 

DE 35 02 049 A refers to a brake pressure control device for 
a motor vehicle having a foot brake valve which transmits 
signals to an electronic control unit which, for its part, 
activates pressure-regulating valves for wheel brakes. 
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WO 01/62569 A refers to an electronic braking control system 
having three power sources for the power s upply . The power 
sources are decoupled from one another by diodes. 

DE 196 40 148 A refers to an electronic braking system having 
5 a plurality of vehicle modules which communicate via a data 
bus, individual modules are DC- isolated from one another by 
optocouplers . 

DE 195 09 150 A refers to a vehicle braking system having at 
least two brake circuits, said braking system respectively 
10 having a control unit which is controlled microprocessors 
which are independent of one another. A monitoring computer 
monitors the two other control units . 

DE 32 04 185 A refers to a pressure-medium braking system 
having a foot brake valve which electrically activates 
15 braking control valves. 

SUMMARY OF THE INVENTION 

It is an object of the exemplary embodiment and/or exemplary 
method of the p resent invention to provide a braking system 
which can be activated electrically, has increased 
20 fail-safety or reliability and can, in particular, also carry 
out higher functions such as ABS, ASR, EBS etc. 

This object ir& may be achieved by mcano of the — features of 

patent claim 3r^ the subject matter described herein. 

Advantageous refinements and developments of the invention 
2 5 can be gathered from the aubclaimo exemplary embodiment and/or 
exemplary method of the present invention are also described 
herein . 

The basic — principlc exemplary embodiment and/or exemplary 

method of the present invention rcoidco in concerns a braking 

30 system comprising at least two or more electrical or 
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electronic braking control systems, individual brake 
actuators or groups of brake actuators being assigned to 
different braking control systems, to be precise in such a 
manner that there are brake actuators which can be activated 
5 by a plurality of braking control systems. 

In the event of a braking control system failing or developing 
a fault, control at "critical" wheels is immediately assumed 
by another braking control system. 

The individual braking control systems arc prcfcrabl y mav be 
10 isolated from one another in such a manner that a fault in 
one of the braking control systems does not affect the other 
braking control system (s). The individual braking control 
systems arc prcf Grably may be DC- isolated from one another. 

Despite being isolated, the individual braking control 
15 systems prcf crabl y may communicate with one another in order 
to make it possible for another braking control system to 
rapidly assume the braking control function, in order to 
coordinate braking activities of brake actuators which are 
activated by different braking control systems and in order 
20 to exchange parameters which have been learnt. 

The brake actuators which are activated by the electronic 
braking control systems arc prcfcrabl y may be "pneumatic brake 
actuators" , that is to say in which the braking force is 
applied pneumatically. This is because, in the case of 
25 electrically actuated brake actuators which are currently 
available, it is not yet possible to build up a satisfactory 
or sufficient braking force. 

The braking system io preferably designed in ouch a manner 
that — it — is poooiblc may be arranged to "easily" change over 
30 from the electropneumatic brake components used nowadays to 
purely electrically controlled components. 
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According to one development of the exemplary embodiment 
and/or exemplary method of the present invention, the control 
circuits each have their own electronic control unit and their 
own power supply. The electrical control circuits activate 
5 electropneumatic pressure regulation modules which are 
supplied with brake pressure by at least two pneumatic supply 
circuits . 

The brake circuits may be divided between individual vehicle 
brakes in different ways. 

10 One option is to assign a brake circuit to a vehicle axle or 
group of axles. Each brake circuit preferably hao may have its 
own control circuit and its own supply circuit, that is to 
say one supply circuit and one control circuit are then 
exclusively assigned to one brake circuit. 

15 Another option is' to provide a first brake circuit, which has 
the function of a service brake circuit, and a second brake 
circuit, which assumes the function of the service brake 
circuit, the braking operations being alternately divided 
equally between the brake circuits. The non-active brake 

20 circuit is respectively tested for faults in this state. In 
the event of a brake circuit failing, the functions are 
immediately assumed and carried out by the other brake circuit, 
further changeovers being effected but a faulty function 
being carried out by a redundant fault -free function. Each 

2 5 brake circuit is respectively provided with its own 
electronic control unit, said electronic control units being 
able to communicate with one another via a communications line 
in such a manner that they are DC- isolated. The service brake 
circuit preferably — hao may have two separate subsupply 

30 circuits which are each connected to their own associated 
pressure-medium store. The first subsupply circuit is 
provided, for example, for the purpose of applying pressure 

MARKED UP VERSION OF 

SUBSTITUTE SPECIFICATION 5 



to pressure regulation modules on a front axle, and the other 
subsupply circuit is provided for the purpose of applying 
pressure to pressure regulation modules on a rear axle. The 
second brake circuit likewise has its own pressure-medium 
5 store. 

The invention io explained in more detail below in connection 
with the drawing , — in which : 

BRIEF DESCRIPTION OF THE DRAWINGS 

fig . Figure 1 shows a first exemplary embodiment in accordance 
10 with the exemplary embodiment and/or exemplary method of the 
present invention ; fig . 

Figure 2 shows a second exemplary embodiment in accordance 
with the exemplary embodiment and/or exemplary method of the 
present invent i on ; fig . 

15 Figure 3 shows a basic circuit diagram of the power supply 
system for the two braking control circuits; 

fig . Figure 4 shows a schematic exemplary embodiment of a 
parking brake valve; and 

fig . Figure 5 shows a schematic illustration of networked 
20 electronic control systems. 

DETAILED DESCRIPTION 

Fig. 1 shows a schematic illustration of an electropneumat ic 
vehicle braking system. Front wheels 1, 2 are each assigned 
a brake cylinder 3, 4, a brake lining wear sensor 5, 6 and 
25 a wheel speed sensor 7, 8. Brake pressure is applied to the 
brake cylinders 3, 4 by associated electropneumat ic pressure 
regulation modules 11, 12 (EPM) via pneumatic lines 9, 10. 
The two pressure regulation modules 11, 12 are connected in 
this case, via a common supply line 13, to a first 
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compressed-air store 14 which is assigned to the front axle. 
The brake lining wear sensors 5, 6 and the wheel speed sensors 
7, 8 are each connected to signal inputs of the pressure 
regulation modules 11, 12 via electrical lines 15, 16. The 
5 pressure regulation modules 11, 12 also each have an 
electrical control input 17, 18, the latter being connected 
to a first electronic control unit 20 via electrical lines 
19 which are shown only schematically in this case. The 
electronic control unit 2 0 thus controls the braking of the 
10 front wheel brakes in this case. 

Rear wheels 21, 22 are each assigned a spring brake cylinder 
23, 24, the latter being connected, via pneumatic brake lines 
25, 26, to associated pressure regulation modules 27 , 2 8 which 
are connected to a second compressed-air store 30 via a supply 
15 line 29. The spring brake cylinders 23, 24 are also connected 
to an electrically activatable locking valve 32 for a common 
compressed-air line 31. 

Like the front axle, the pressure regulation modules 27, 2 8 
are connected to associated brake lining wear sensors 35, 36 

20 and wheel speed sensors 37, 38 via electrical lines 33, 34. 
The pressure regulation modules 27, 28 have control inputs 
39, 40 which are connected, via electrical lines 41 which are 
shown only schematically in this case, to a second electronic 
control unit 42 which activates the brakes of the vehicle rear 

25 axle in this case. 

The parking brake valve 32 which is shown in detail in fig. 
4 and is described therein is connected to the first 
electronic control unit 20 via an electrical control line 43 
and to the second electronic control unit 42 via an electrical 
30 control line 44 . A pneumatic line 46 also leads from the 
parking brake valve 32 to a third pressure -medium store 4 7 
via a nonreturn valve 45. The three pressure-medium stores 
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14, 3 0 and 47 are each connected to a common pressure 
distribution device 48 which is fed by a pressure-generating 
device 49 (compressor) . 

The two electronic control units 20, 42 are connected to an 
5 associated bus VehComl and VehCom2 , respectively, via 
electrical lines 50, 51. These bus lines are used to connect 
the vehicle braking system to other electrical or electronic 
vehicle systems. In particular, a braking request signal 
which is prescribed by the driver using the brake pedal is 
10 supplied to the electronic control units 20, 42 via these 
buses . 

The electronic control unit 20 is connected to a positive line 
VI via an electrical line 52. Accordingly, the electronic 
control unit 42 is connected to a second positive line V2 via 

15 an electrical line 53. The positive line VI is connected to 
the positive terminal of a first battery 54 and the second 
positive line V2 is connected to the positive terminal of a 
second battery 55 . The positive terminals of the two batteries 
54, 55 are connected to one another via a DC- isolation device 

20 56, which will be explained in even more detail in connection 
with fig . 3 . 

The positive terminal of the battery 54 is also connected to 
an AC generator (dynamo) via a rectifier 57. 

The two electronic control units 20, 42 are also connected 
25 to one another via a communications line 58 and a DC-isolation 
device 59. 

In the case of the braking system shown in fig. 1, a "dual 
electronic control system" having two separate power supply 
devices is provided for the purpose of improving the 
30 fail-safety. Even though the two electronic control circuits 
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are DC-isolated from one another, the two batteries 54, 55 
can have a common ground connection. 

The braking request signal from the driver is supplied to the 
two electronic control units using electrical brake pedal 
5 signals. Mechanical parts have a. fail-safe design. By 
contrast, electronic components are duplicated and are 
mechanically isolated and DC-isolated from one another. 

In fig. 1, the '"division" of the electronic control system 
corresponds to the "division" of the pneumatic supply 
10 circuits, that is to say the supply and control circuits are 
each divided between the front and rear axles. 

Fig. 2 shows a brake circuit which has been improved further 
and in which all of the vehicle brakes can be actuated even 
in the event of a fault in the "primary brake circuit" . 

15 Fig. 2 shows a further development of the braking system shown 
in fig. 1. In this case too, the braking system has two brake 
circuits, namely a first brake circuit as the service brake 
circuit (primary circuit) , which controls the braking of all 
wheels of the vehicle and of a trailer vehicle (which may be 

2 0 present) when the braking system is intact, and a second brake 
circuit (secondary circuit) , which controls the braking of 
all wheels of the vehicle and of a trailer vehicle (which may 
be present) if the service brake circuit, that is to say the 
first brake circuit, has failed. 

25 In this case, the first brake circuit is formed primarily by 
the pressure regulation modules 11, 12 on the front axle and 
the pressure regulation modules 27, 28 on the rear axle. 
Analogously to fig. 1, the pressure regulation modules 11, 
12 are supplied with storage pressure by the first 

30 pressure-medium vessel 14 via a pneumatic line 13. The second 
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pressure -medium vessel 30 supplies the pressure regulation 
modules 27, 2 8 via the pneumatic line 29. 

■ 

The pressure regulation modules 11, 12 are also connected to 
a control output 6 0 of a foot brake valve 61 via a pneumatic 
5 control line 60' . The pneumatic control line 60' is likewise 
connected to the first pressure-medium vessel 14 via the foot 
brake valve 61. 

The second pressure -medium vessel 30 is connected, via the 
foot brake valve 61, to a control output 62 of the foot brake 

10 valve 61, to which control inputs 64, 65 of pressure 
regulation modules 66, 67 of the second brake circuit are 
connected via a control line 62'. The pressure regulation 
modules 66, 67 of the second brake circuit are also connected 
to the third pressure -medium vessel 47 via a pneumatic supply 

15 line 68, 69. 

The pressure regulation modules 27, 28 of the service brake 
circuit on the rear axle are likewise connected to the 
pneumatic control output 60 of the foot brake valve 61 via 
a pneumatic control line 70. 

2 0 Like the front axle, two further pressure regulation modules 
71, 72 of the second brake circuit are also provided on the 
rear axle, said pressure regulation modules being supplied 
with compressed air by the third pressure-medium vessel 47 
via the pneumatic supply line 68, 69 and likewise being 

2 5 connected to the pneumatic control output 62 of the foot brake 

valve 61 via a pneumatic control line 63. The pressure 
regulation modules 66, 67, 71, 72 of the second brake circuit 
are connected to the second electronic control unit 42 via 
electrical connecting lines 73. It goes without saying that 

3 0 it is possible to assign the pneumatic control outputs 60, 
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62 of the foot brake valve 61 to the pressure regulation 
modules 11, 12, 27, 28, 66, 67, 71, 72 in another manner. 

Analogously to this, the pressure regulation modules 11, 12, 
27, 28 of the service brake circuit are connected to the first 
5 electronic control unit 20 via an electrical line 74. 

The pressure regulation modules 11, 67 and 12, 66 are each 
connected to the brake cylinders 3, 4 via an associated 
high-pressure selection valve 75, 76 and the pneumatic lines 
9, 10 . 

10 Analogously to fig. 1, the brake lining wear sensors 5, 6 and 
the wheel speed sensors 7, 8 are connected to the pressure 
regulation modules 11, 12 of the service brake circuit. In 
addition to this, a second wheel speed sensor 77, 78 is 
respectively provided in the exemplary embodiment shown in 

15 fig. 2, said wheel speed sensors being connected to the 
pressure regulation modules 6 7 and 6 6 of the second brake 
circuit . 

Analogously to this, wheel speed sensors 79, 80 and brake 
lining wear sensors 35, 36, which are connected to the 
20 pressure regulation modules 71, 72 of the second brake circuit, 
are also provided on the rear axle in addition to the wheel 
speed sensors 37, 38 which are connected to the pressure 
regulati on modules 27, 28 of the service brake circuit. 

The foot brake valve 61 also has electrical control outputs 
25 which are connected, on the one hand, to the electronic 
control unit 20 via an electrical line 81 and, on the other 
hand, to the electronic control unit 42 via an electrical line 
82. Analogously to fig. 1, control inputs of the parking brake 
valve 32 (which additionally has a further manual control 
30 input 83 in this case) are connected to the electronic control 
unit 20 and to the electronic control unit 42. 
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In addition to fig. 1/ a further pressure regulation module 
84 which is connected to a trailer control valve 85 via a 
pneumatic control line are provided in fig. 2. The pressure 
regulation module 84 is supplied with storage pressure by the 
5 third pressure -medium vessel 47 via the storage line 69 and 
is connected to the second electronic control unit 42 via an 
electrical control line 86. A pneumatic control line 87 for 
the parking brake of a trailer vehicle is also provided 
between the parking brake valve 32 and the trailer control 
10 valve 85. The trailer control valve 85 is likewise connected 
to the first electronic control unit 20 via an electrical 
control line 88. 

Analogously to fig. 1, the two electronic control units 20, 
42 are connected to the positive terminals VI and V2 via the 

15 lines 52, 53 and to bus lines VehComl and VehCom2 via the lines 
50, 51. Connecting lines 89, 90 to TrComl and TrCom2 
connections are additionally provided in this case, said 
connections leading to a trailer. Power supply via the 
batteries 54, 55 corresponds to fig. 1. In contrast to fig. 

2 0 1, the pressure distribution device 48 is likewise connected 
to the VehComl bus here, can isolate a faulty compressed-air 
supply circuit and maintains the requisite system pressure 
for all of the other circuits. 

Like fig. 1, the two electronic control units 20, 42 are 
25 connected to one another via the electrical line 58 and the 
DC-isolation device 59 . This connection prevents an actuator, 
for example, being activated by different control devices at 
the same time. 

Analogously to the front axle, the pressure regulation 
30 modules 27, 71 and 28, 72 are also each connected, on the rear 
axle, to inputs of the spring brake cylinders 23, 24 via a 
high-pressure selection valve 91, 92. 
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The high-pressure selection valves (high select) 75, 76, 91, 
92 ensure that the higher of the two brake pressures of the 
connected brake circuits is respectively transmitted to the 
brake cylinders. During normal operation, the service braking 
5 system "overrides" the second braking system, the pressures 
in the second brake circuit being somewhat lower than in the 
service brake circuit. This ensures reliable pressure control 
and makes it possible for the second brake circuit to check 
its own "operational capability" , for example by measuring 
10 the pressure at the outputs of the pressure regulation modules 
66, 67 and 71, 72 of the second brake circuit, that is to say 
upstream of the high-pressure selection valves 75, 76, 91, 
92 . 

The valve components are now present "singly" from the output 
15 of the high-pressure selection valves 75, 76, 91, 92. They 
are accordingly of failsafe design. 

The uppermost level of the electronic control system of the 
braking system is implemented using the two electronic 
control units 20, 42 (main electronic control unit and second 
electronic control unit) . The two electronic control units 
have two communications connections 58, 59 which are 
independent of one another and are DC- isolated from one 
another. These "connecting lines" can be used to carry out 
plausibility checks on the two independent circuits. "Learnt" 
and instantaneous or measured braking parameters can also be 
exchanged. The "main ECU" (electronic control unit 20) 
controls all of the vehicle brakes during normal operation 
and also if the second system has developed a fault or has 
failed . 

3 0 In the event of the main braking system failing, the second 
system controls braking. The main system has a pneumatic 
pressure supply via the pressure-medium store 14 for the front 
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axle and via the pressure -medium store 3 0 for the rear axle 
and controls the pressures using the associated pressure 
regulation modules 11, 12, 27, 28. 

In order to increase reliability, two wheel speed sensors are 
5 provided at each wheel, one being assigned to the respective 
pressure regulation module of the service brake circuit and 
the other being assigned to the associated pressure 
regulation module of the second brake circuit. 

The foot brake valve 61 is connected to the two ECUs, that 
10 is to say to the electronic control units 20, 42, with the 
result that DC-isolation is ensured, thus enabling 
plausibility checks . 

Each ECU has a data connection to its associated superordinate 
control unit, from which external braking requests can be 
15 accepted. These data connections must, of course, be 
DC-isolated from the two braking control circuits. 

The parking brake is activated exclusively electronically by 
the two independent ECUs and is directly activated 
electrically by the driver, to be precise in the following 
20 manner. Electrical actuation of the parking brake by the 
driver precedes electronic control by the two ECUs. However, 
the parking brake is released only when there are release 
signals from the ECUs and from the driver. 

Fig. 3 shows an enlarged illustration of the power supply 
25 system for the braking control system shown in fig. 2. A 
generator 93 (dynamo) generates a voltage and is connected 
to the positive terminal of the battery 54 and to the 
DC-isolation device 56 (supply duplicator unit) . The positive 
terminal of the battery 55 is likewise connected to the 
30 DC-isolation device. The positive terminals of the two 
batteries 54, 55 are thus DC-isolated. The DC-isolation may 
MARKED UP VERSION OF 
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be realized, for example, using a converter with 
electromagnetic transmission . 

The negative terminals of the two batteries 54, 55 and the 
generator 93 each have a common ground connection (GND) . The 
5 potential VI can be tapped off from the positive terminal of 
the battery 54 and the potential V2 can be tapped off from 
the positive terminal of the battery 55. The isolation device 
56 also has electronic monitoring units 94, 95 which are 
connected to the bus lines VehComl and VehCom2 . The electronic 
10 monitoring units 94, 95 monitor and control the charging and 
discharging operations, to be precise in such a manner that 
the lives of the batteries are optimized. 

Since not all of the electrical systems in a vehicle are 
relevant to safety, not all of the systems need to be 
15 "duplicated" either. The power supply system is therefore of 
"asymmetrical" design . 

The main system, that is to say, for example, the battery 54, 
supplies power to all of the main loads, for example starter, 
lights, drive controller, the primary electronic braking 

20 control circuit, the primary electronic steering control 
circuit etc. The secondary system, that is to say the battery 
55, supplies power to the "subordinate" back-up components 
of all the safety-relevant systems, that is to say the 
electronic back-up braking control circuit and an electronic 

25 back-up steering control circuit. 

On account of the "asymmetry" , the second battery may have 
a smaller capacity than the first, and another type of battery 
may also be used. The batteries 54, 55 are thus matched to 
one another in terms of size, capacity, charging and 
30 discharging curves etc. 
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The AC generator 93 (dynamo) charges the first battery 54 and 
- in a DC- isolated manner - also the second "back-up battery'' 
55. In the event of a fault in a supply circuit, the "supply 
duplicator unit" 56 and the electronic monitoring units 
5 ensure the integrity of the other circuit . 

Optimum use of the batteries requires charging and 
discharging methods which are matched to the batteries, this 
being monitored by the electronic control devices 94, 95. The 
charging and discharging operations are thus intended to be 
10 carried out, as far as possible, in accordance with prescribed 
"charging and discharging curves'' . The electronic control 
devices 94, 94 are thus used as "intelligent charging and 
discharging control devices" . 

Since, in the case of fully electronic control of 
15 safety-relevant systems, the state of the batteries is a very 
important item of information, the isolation device 56 has 
two DC- isolated data connections (not shown) via which 
battery state signals are transmitted. 

Fig. 4 shows a schematic exemplary embodiment of the parking 
20 brake valve 32. It comprises two function valves FV1 , FV2 , 
two locking valves LV1 , LV2 , two pressure sensors PS1, PS2 
and two trailer check valves TCI, TC2 . The valves FV1 and LV2 
switch the upper air path of the parking brake valve 32, and 
the valves FV2 and LV1 switch the lower air path. The valves 
2 5 FV1 and LV1 are controlled by the first electronic control 
unit 20, and the valves FV2 and LV2 are controlled by the 
electronic control unit 42. Normally, the function valves FV1 , 
FV2 control the functioning of the parking brake. In the event 
of a fault in a function valve (for example FV2) , the 
30 associated locking valve LV1 will block the faulty air path. 
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A relay valve RV is a power valve and is controlled by the 
valves FV1, FV2 , LV1 , LV2 since the latter are not capable 
of actuating the spring brake cylinders 23 , 24 rapidly enough. 

The trailer check valves TCI, TC2 are responsible for checking 
5 the spring brake action. 

If the function valve FV1 or its controller has a fault, the 
locking valve LV2 is actuated and the upper air path is thus 
blocked. In this case, correct functioning is still ensured 
by the function valve FV2 and the locking valve LV1 . 

10 If the locking valve LV2 or its controller has a fault, the 
two function valves FV1 , FV2 must still be activated, and 
correct functioning is thus still maintained. 

In order to detect faults in the parking brake system, use 
is made of two pressure sensors PS1, PS2 which are 
15 interrogated in the switching sequences of the function 
valves FV1, FV2 and locking valves LV1 , LV2 . 

In the event of all the electrical supply voltages failing, 
the parking brake valve 32 will brake. 

Fig. 5 shows a schematic illustration of networked electronic 
20 control systems having multiple redundancy levels. Only 
control systems ECU_1 to ECU_16 with their supply lines and 
communications connections are shown. The control systems are 
arranged in system groups. ECU_1 to ECU_5 are the basic 
systems, for example brake, steering, vehicle dynamics, 
25 engine control, transmission control etc. These systems are 
supplied by a power generator G via a supply line V_l . The 
associated energy store is a battery BATT_1 . The next group 
is formed by the control systems ECU_6 to ECU_8 , which group 
is also supplied by the power generator G. However, the supply 
30 line contains a transducer TR_1 , to which a supply line V_2 
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is connected. The group of control systems ECU__6 to ECU_8 are 
the most safety-critical redundant pairs of the control 
systems ECU_1 to ECU_5 (for example brake 2, steering 2, 
vehicle dynamics 2) . 

5 The communications lines of the control systems are also 
isolated from one another by transducers. A communications 
connection thus exists, for example, between the control 
systems ECU_1 to ECU_8 by virtue of the communications line 
COM_l which is connected to a communications line C0M_2 of 
10 the control systems ECU_6 to ECU_8 by the transducer TR_1 . 

Fig. 5 shows quadruple redundancy in which four transducers 
TR_1 to TR_4 are used. 

The position of the control systems ECU_15 to ECU_16 shows 
another possible way of using transducers. These control 

15 systems are connected to one another by means of a supply line 
V_5 and a communications line COM_5 and are connected to the 
transducer TR__4 . The transducer TR_4 forms the connection to 
the supply line V__3 and to the communications line COM__3 which 
are, in turn, connected to the supply line V_l and to the 

20 communications line COM_l by means of a further transducer 
TR_2 . 

The transducers TR_1 to TR_4 form DC- isolation devices 
between the various redundancy levels. 
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braking system for vehicles, including at least one first 
brake circuit, and at least one second brake circuit, in which 
5 the at least one first brake circuit and the at least one 
second brake circuit each have an electrical control circuity 
which respectively has an electronic control unit and its own 
power supply device, and brake actuating devices which are 
activatable by the electronic control units, at least one_of 

10 the brake actuating devices being activatable by more than 
one of the electronic control units, in which the brake 
circuits are electrically act ivata ble via a foot brake valve, 
and the foot brake valve has two electrical braking 
transmitter devices which are each connected to the 

15 electronic control units so that they are DC- isolated^ 



MARKED UP VERSION OF 
SUBSTITUTE SPECIFICATION 



19 



